OS Lab 8 - Transport and Security - Revizia istoricului

Vserbu: /* Practice: TLS-Secured Connection */

2025-11-28T14:49:22Z

Practice: TLS-Secured Connection

Vserbu: /* Environment Setup */

2025-11-28T14:41:06Z

Environment Setup

Vserbu: /* Environment Setup */

2025-11-28T14:38:57Z

Environment Setup

Vserbu: /* Introduction */

2025-11-28T14:32:45Z

Introduction

Vserbu: /* Objectives */

2025-11-28T14:32:02Z

Objectives

Vserbu la 28 noiembrie 2025 14:00

2025-11-28T14:00:03Z

Vserbu: /* TLS: Transport Layer Security */

2025-11-28T13:26:22Z

TLS: Transport Layer Security

Vserbu: Pagină nouă: == Objectives == Upon completion of this lab, you will be able to: * Explain the fundamental differences between Connectionless (UDP) and Connection...

2025-11-28T13:24:46Z

Pagină nouă: <span id="objectives"></span> == Objectives == Upon completion of this lab, you will be able to: * Explain the fundamental differences between Connectionless (UDP) and Connection...

Afișare diferențe

@@ Linia 1.388: / Linia 1.388: @@
 '''Step 3: Start the Secure Client'''
-In Terminal 3, connect from Red with TLS enabled:
+In Terminal 3, attempt connect from Red with TLS enabled:
-<syntaxhighlight lang="bash">sudo ip netns exec red ncat --ssl --ssl-verify --ssl-trustfile pki/ca.crt 10.0.0.3 8443</syntaxhighlight>
+<syntaxhighlight lang="bash">sudo ip netns exec red ncat --ssl --ssl-verify --ssl-trustfile pki/ca.crt blue.lab 8443</syntaxhighlight>
 Command breakdown:
@@ Linia 1.396: / Linia 1.396: @@
 * <code>--ssl-verify</code>: Verify server certificate (don't accept self-signed or invalid certificates)
 * <code>--ssl-trustfile pki/ca.crt</code>: Trust anchor (our CA certificate)
-* <code>10.0.0.3 8443</code>: Connect to Blue on port 8443
+* <code>blue.lab 8443</code>: Connect to Blue on port 8443
-You should see the connection succeed. If you see an error like &quot;certificate verification failed,&quot; check:
+You should see the connection succeed. If you were to attempt to connect to 10.0.0.3 instead of blue.lab, it would FAIL because of hostname mismatch.
 '''Step 4: Observe the TLS Handshake'''
@@ Linia 1.467: / Linia 1.463: @@
 <span id="understanding-what-happened"></span>
 ==== Understanding What Happened ====

← Versiunea anterioară		Versiunea de la data 28 noiembrie 2025 14:41
Linia 656:		Linia 656:

	<syntaxhighlight lang="bash">sudo ip netns exec red ping -c 2 10.0.0.3</syntaxhighlight>		<syntaxhighlight lang="bash">sudo ip netns exec red ping -c 2 10.0.0.3</syntaxhighlight>
		+	Not test connectivity using hostnames
		+
		+	<syntaxhighlight lang="bash">sudo ip netns exec red ping -c 2 blue.lab</syntaxhighlight>
	Test internet access from Red:		Test internet access from Red:

@@ Linia 548: / Linia 548: @@
 # Assign IP addresses and routes
 # Enable NAT for internet access
 <span id="step-1-create-the-setup-script"></span>
@@ Linia 607: / Linia 608: @@
 nft add chain ip nat postrouting { type nat hook postrouting priority srcnat \; } 2>/dev/null || true
 nft add rule ip nat postrouting ip saddr 10.0.0.0/24 oifname "$IFACE" masquerade 2>/dev/null || true
 echo ">>> Setup Complete"
@@ Linia 619: / Linia 629: @@
 * <code>ip route get 8.8.8.8</code>: A way to determine which interface routes to the internet
 * <code>grep -oP 'dev \K\S+'</code>: Extract just the interface name
 * NAT commands use <code>|| true</code> to be idempotent (can run multiple times safely)
@@ Linia 658: / Linia 669: @@
 <span id="hands-on-exercises"></span>
 == Hands-on Exercises ==

@@ Linia 40: / Linia 40: @@
 We'll not only establish connections between our virtual machines (Red and Blue namespaces) but also implement complete TLS encryption to prevent eavesdropping. By using <code>tcpdump</code> to inspect packets &quot;on the wire,&quot; we'll see firsthand the difference between plaintext and encrypted communications, demonstrating why TLS has become the universal standard for web traffic.
 <span id="prerequisites"></span>
 == Prerequisites ==

@@ Linia 12: / Linia 12: @@
 * Verify encryption effectiveness by inspecting packets with <code>tcpdump</code> to demonstrate the difference between plaintext and encrypted traffic.
 * Understand the trust model of PKI and certificate chains used in modern HTTPS and secure communications.
 <span id="introduction"></span>
 == Introduction ==

@@ Linia 789: / Linia 789: @@
 Provide the following:
-# '''tcpdump Output''': Screenshot or text of the tcpdump output showing at least one UDP packet. The output must clearly show:
+# '''tcpdump Output''': Screenshot of the tcpdump output showing at least one UDP packet. The output must clearly show:
 #* Source IP and port (Red, ephemeral)
 #* Destination IP and port (Blue, 9000)
 #* The plaintext message in the hex/ASCII dump
 <span id="exercise-b-tcp-communication-and-socket-state-inspection"></span>
@@ Linia 1.057: / Linia 1.056: @@
 #* Packet 2: SYN-ACK (Flags [S.])
 #* Packet 3: ACK (Flags [.])
 <span id="exercise-c-public-key-infrastructure-creating-a-certificate-authority"></span>
 === Exercise C: Public Key Infrastructure (Creating a Certificate Authority) ===
@@ Linia 1.317: / Linia 1.311: @@
 #* The Subject (should be blue.lab)
 #* The Validity dates
 <span id="exercise-d-secured-transport-with-tls-encryption"></span>
@@ Linia 1.495: / Linia 1.485: @@
 ==== Deliverable D: Provide the following: ====
-# '''tcpdump Output''': Screenshot or text of the packet capture showing encrypted data. The output must clearly show:
+# '''tcpdump Output''': Screenshot of the packet capture showing encrypted data. The output must clearly show:
 #* Source and destination (Red to Blue on port 8443)
 #* The hex dump of the payload
@@ Linia 1.502: / Linia 1.492: @@
 #* Exercise A UDP packet capture (plaintext visible)
 #* Exercise D TLS packet capture (encrypted)
 <span id="reference-command-quick-guide"></span>

@@ Linia 383: / Linia 383: @@
                                   ←---------------------- ServerHello
-                       (chosen cipher, TLS version, random nonce)
+                                                         (chosen cipher, TLS version, random nonce)
-                                                    Certificate
+                                                         Certificate
-                                          (server's public key + CA signature)
+                                                         (server's public key + CA signature)
-                                              ServerKeyExchange
+                                                         ServerKeyExchange
-                                                  ServerHelloDone
+                                                         ServerHelloDone
 ClientKeyExchange ------------------------------------→
@@ Linia 395: / Linia 395: @@
                                   ←--------------- ChangeCipherSpec
-                                                        Finished
+                                                  Finished
 [Encrypted Application Data] ←----------------→ [Encrypted Application Data]</pre>
@@ Linia 414: / Linia 414: @@
 <span id="public-key-infrastructure-pki"></span>
 ==== Public Key Infrastructure (PKI) ====